Step CA, an online certificate authority, contains a vulnerability that permits a crafted attestation key certificate with an empty Extended Key Usage extension to trigger an index out‑of‑bounds panic during TPM device attestation. The panic occurs when the code decodes the EKU ASN.1 value and attempts to access the first element of an empty sequence. This flaw is classified as CWE‑129 and results in an application crash, denying certificate issuance services to clients that trigger the attack. The impact is limited to service disruption rather than data theft.

Affected deployments run smallstep certificates versions 0.24.0 through the last release before 0.30.0‑rc3 and only if the device‑attest‑01 ACME challenge is configured to use TPM attestation. Systems that do not employ TPM attestation are not impacted.

The CVSS score of 3.7 reflects a low to medium severity focus on denial of service. No EPSS score is available, and the vulnerability is not listed in CISA KEV, indicating no publicly known exploits yet. The attack vector is inferred to be internal or privileged, requiring the ability to supply a crafted AK certificate during a TPM attestation challenge. The fix implemented in 0.30.0‑rc3 removes the bounds check flaw. As the condition is limited to a specific configuration, the likelihood of exploitation without this configuration is very low. Nevertheless, an attacker with access to the attestation path can deliberately disrupt service by repeatedly sending crafted certificates.